80 Million and a Spelling Error: Hacking (Night's Black Agents)

When I was just starting out as a low level employee for a financial institution I shall not name, a senior staff member was caught with his fingers in the electronic till. He rigged the system so that, every so often, dormant accounts or trust funds would deposit a trifling amount of money in his personal account. It was never much more than a few dollars, even cents, at a time, but spread over many accounts and over a long period of time those small sums added up to one big payout. He was caught when he went to lunch one day and forgot to lock his machine. Someone came into his office to drop something off, noticed the suspicious activity on his monitor, and passed it on to the higher-ups. It became a police matter very soon after that.

I was reminded of him when I read about the $80 million heist carried out electronically via the Bangladesh Bank. His scheme wasn't original, but it paid off big time, and he would have gotten clean away had he not made a very simple mistake, the kind of error we all make every day. Not quite cautious enough, not quite careful or suspicious enough, and it's game over. It's stories like these that have me paying cash rather than electronic POS whenever I can.

If you haven't already read this one: sophisticated criminals ripped off the central bank of Bangladesh, breaching its systems and then sending requests for money transfer to the US Fed, where Bangladesh Bank had billions stored. Several transfers took place, only for the whole thing to come crashing to a halt when someone misspelled the word Foundation as Fandation on one of the request forms. If that request had gone through the gang - and given the level of preparation it probably was a gang - would have made off with at least a billion, and probably more, since there's no reason to think they would have stopped until Bangladesh's accounts were empty. An IT expert who publicly voiced suspicion that apathetic bank officials had, at the very least, contributed to the caper through their negligence has gone missing. The bank's governor resigned; apparently his employees failed to tell him what had happened, and he only found out about the heist when it hit the papers. Though the bank has said it expects to recover some of the money it seems likely that the bandits will make a clean getaway. Most of it went to casinos in the Philippines, presumably so it could be efficiently laundered, and as a consequence the Philippines may once again be blacklisted by the Money Laundering Task Force. This is all the more important for the Philippines because there are elections coming in May; this kind of news is the last thing the ruling Liberal party needs. At least $30 million in cash ended up in the hands of an ethnic Chinese in Manila, but as for the rest, it could be anywhere.

So what does this story tell us about what it takes to be a hacker in Night's Black Agents?

To begin with, as discussed in last week's post on black baggers, you have to know a lot about human nature and how organizations work. Whoever did this had to know how Bangladesh Bank operated. They probably studied the habits of bank employees for some time before making a move, both in the real world and via keylogger virus or similar on their work machines. They knew when to strike, and how, for maximum impact.

This has been the case since time immemorial, which in computer terms goes back all the way to last week Tuesday. I have on my bookshelf Secrets of a Super Hacker by someone writing under the pseudonym Knightmare. It's hopelessly out of date from a technical perspective - if ever I want to know how to cut up an 8 inch floppy, Knightmare has me covered - but its lessons on interpersonal interaction and information finding are still very relevant. One chapter's devoted to social engineering, another to reverse social engineering, and he spends a remarkable amount of time discussing the joys of dumpster diving and how information found in the trash can help you pillage companies' accounts.

Speaking of, I wonder what Bangladesh Bank did with its trash. Even today banks generate so much paper, reams of physical data. You'd like to think it was all shredded, pulped or otherwise rendered unreadable. But maybe not; after all, Kapersky Labs has a very beautiful interactive map that claims Bangladesh is, at time of writing, the 41st most attacked country in the world. These things don't happen by chance. That same map says Russia is #1 - not an award to be proud of, hope those nuclear silos are doing just fine - Vietnam is #3, the US is #2, and most of Europe seems to be hovering in the 10s and 20s. Apart from Norway, Sweden and Finland, which are #133, #87 and #149. Come on, guys, Finland's not that bad. I know some great Finns. Don't be shy. Bear in mind this is real time data, so by the time you read this everything will have changed, with the possible exception of the top 2.

Incidentally, Kapersky, I notice Bermuda doesn't even feature on the map. Way to hurt my feelings, fellas.

So we're looking at Bureaucracy, Human Terrain, and probably Reassurance to reflect social engineering, and Urban Survival for those dumpster diving expeditions. The hacker is an urban animal; no hiking through the piney woods and living off fresh caught fish or beef jerky for this bunch. A decent Infiltration pool might also be helpful, for breaking into installations and making off with the contents of the shredder. With enough dedication almost anything can be pieced back together. It isn't about whether it can be done, but rather if it's worth the effort. Research is a must, as is Traffic Analysis. Depending on whether or not the hacker makes a dishonest crust by, say, fleecing banks in Bangladesh, or catching those who do, points in Streetwise or Criminology might be in order.

While the hacker is probably the least athletically inclined of all the Night's Black Agents types, it would be a very foolish player who didn't put some points in self defense. However pools in Mechanics and Surveillance are more likely. You're the one who watches, not the one who goes in with a cosh and a black bag.

With all that in mind, consider this example:

Kayo

One sentence: Former Nollywood actor and con artist shooting for the big leagues.

Investigative: Accounting 1, Bureaucracy 1, Bullshit Detector 3, Cryptography 1, Data Recovery 2, Electronic Surveillance 2, Human Terrain 2, High Society 1, Research 1, Traffic Analysis 1, Reassurance 2, Languages 2, Streetwise 1, Urban Survival 1

General: Athletics 8, Cover 10, Digital Intrusion 15, Disguise 6, Health 8, Infiltration 10, Mechanics 4, Network 15, Shooting 8 (base 14, with special weapons training), Stability 7, Surveillance 5, Sense Trouble 1.

MOS: Digital Intrusion (silly not to, really).

Cherries: Athletics (Parkour), Digital Intrusion (cracker's cryptid), Infiltration (open sesame), with special weapons training in the AK47. I picture this as an actor's conceit, for when Kayo decides to relive his glory days in Mafia Soldiers or the like.

As has become traditional, let's end this with a scenario seed:

A not for profit has announced a competition, the Shreddathon Challenge, to see who can be the first to piece together five sets of shredded documents, with $50,000 going to the winner. One team, the Hatfall Brigade, was coming very close to this goal with its specially designed computer program, but just as the final pieces were coming together three of the five programmers were brutally murdered, and the program was stolen. Shortly afterward the hacking community discovers that the not for profit hosting the challenge only ever existed in cyberspace; its backers have disappeared. What happened to the team, and what was the Shreddathon Challenge really all about?

Assassination (GUMSHOE All)

Once upon a time there was a rich asshole named Ross Perot. He owned a nice house in Bermuda, but became very upset because he couldn't dock his yacht. There were reefs in the way. So he brought in a few explosives experts and blew up the reef. This was, as you might imagine, contrary to local law. The rich asshole told local law to fuck off, and off it duly fucked. 

However, Perot did at least have the decency to make sure his explosives experts got off the island without spending a night in jail. He did this by putting them on board his private plane and zipping them out of the country within a few hours of the explosion.

I mention this because I, like many of you, have been paying attention to recent events in Haiti. 

If you're going to go to the trouble of assassinating a president, why wouldn't you make sure the assassins fled the country?

Answer: you do that when you don't care what happens to the assassins, probably because they're idiots. With the possible exception of those few still on the run as of time of writing, who may be out of the country by now. Bet the triggerman (men?) had a plane or boat waiting. Either that or a shallow grave. Perhaps both.

Some sources claim the mercs had nothing to do with it, that President Moïse was actually killed by third parties shortly before their arrival. Plausible, certainly. It would mean the mercs are basically expendable patsies. Gullibles. 

But, God a'mighty, how dumb do you have to be to answer an advert on the internet looking for someone to help arrest a president? Hands up who thinks American agents from whichever agency it may be can go to a foreign country, arrest and extradite any member of its government, whether the president or the local garbage collector. Go on, shame yourselves.

Nigerian 419 victims are Mensa members compared to Haitian American James Solages, who claims to have been hired to help execute a warrant, not a person. Or Manuel Antonio Grosso Guarín, former member of the Columbian armed forces, who posted pictures of his Haitian vacation on Facebook shortly before the deed.

Sourced from 2008 Cohen film Burn After Reading

The other question floating across my forebrain is why the hell did whoever the brains of the operation is need twenty eight people to shoot one man? [Assuming that the President's own guard didn't do him in prior to their arrival, of course.] Though I suppose the answer is, Brains didn't have anyone on the payroll capable of sneaking in like Sam Fisher, so Brains hired a mess of morons to ram-raid the place. Creche of cretins? Band of boobs? 

Gosh, if only Brains had a couple of pretty girls with a spray bottle. Or some kind of Heath Robinson remote control rifle. It would have been so much easier.

Frankly, it just goes to show - if it needed showing - that thriller writers whose protagonists or antagonists are highly skilled ex-SAS/Special Forces types capable of killing a man sixteen different ways with a pencil, and who effortlessly execute insanely complex schemes while simultaneously completing the New York Times crossword, in pen, are talking out of their arses. 

Paid killers aren't geniuses. Spies aren't charismatic James Bond types. They're silly, greedy little idiots playing with toys, or ex-military who've spent too long in the sun. 

I mean, look at some of these clowns. The spy who couldn't spell. Kevin Mallory, who China paid a measly $25K for state secrets and is now spending his twilight years in prison. Mark Thatcher (fucked if I'll call him Sir, much less The Honorable) who bankrolled a coup and has since been refused residency in Monaco and Gibraltar, jurisdictions not famous for their integrity. Or, as Sir Roger Moore once said of Monaco's new quasi-criminal citizens, 'how do you say piss off in Russian?'  The Achille Lauro PLO hijackers. Dangerous? Certainly. In the same way a 4 year old with a handgun is dangerous. But you'd never see these loons in a James Bond film.

Honestly, it gives me hope when I read about $80 million bank heists. Not that I want banks robbed, but at least someone's putting the effort in. That was a clever stunt. Or the Hatton Garden crew. Though to be fair the Bangladesh Bank Burglars were let down by a spelling error, and the Hatton Garden robbers were arrested after blabbing in a pub which the police were surveilling. Human nature strikes again.

Night's Black Agents and games like it thrive on highly skilled ex-SAS/Special Forces types doing the impossible and looking damn cool in the process. NBA even proposes the Hit as a potential active mission:

The agents must kill someone. This can be a simple sniping, or a gang rumble. Provide the target and his security, plan a weakness in one or both. 

Of course, it doesn't come with an exfiltration plan. 

Let's play with the concept, in a little scene I'll call:

A Large Splodge of Wonga!

[Wonga = cash. Quote from Simon Mann, one of Mark Thatcher's pals.]

The Hit went off more or less successfully. The agents might have lost some assets or a Network contact or two, but the target is down. Time to make that clean getaway ... 

What happened to our clean getaway?

Mr. Smith let the side down, and either failed to arrange an exfiltration or just didn't bother. The agents are in hostile territory, with few escape routes. I've done something similar in Macau before, but that assumed vampiric involvement. This is a straight, old-fashioned hit, with no supernatural elements.

As to exactly where, I'll leave that to the Director. It could even be somewhere entirely fictional - in Swords of the Serpentine, say. The location's key characteristics are:

1. Small, as in Lichtenstein small.  
2. Relatively isolated. You can fly out or catch a boat, but either there are no land borders or the ones that do exist are cut off by mountains or similarly difficult terrain. Deserts, jungles, that kind of thing. 
3. Alternatively it's easy to get across the border, but the folks on the other side are even less welcoming that the ones you're fleeing from. Diplomacy needed to wangle a safe harbour. 
4. Heavily armed. The hostile territory's armed forces, police, internal security possess sophisticated armaments and aren't shy about using them. Shoot first and ask questions never is their operating protocol.
5. Even more heavily armed. Never mind the cops; the average citizen has a handgun, shotgun, SMG, machete, and is especially jumpy right now. So don't provoke an armed mob, not unless you like being barbecued.
6. Game of Thrones. The hostile territory's government has a few would-be leaders waiting in the wings. Theoretically the agents could cut a deal with one of these claimants: safety in return for ... something. 
7. Asset rich, aka Wild Geese. The hostile territory possesses something that the outside world really wants. That means there are important state and non-state actors who might get involved, for a price. Maybe the Chinese Embassy will provide safe haven, or that mysterious multinational conglomerate can lend a jet. 

Start at Heat 6 minimum. After all, the agents did kill someone important. Starting Heat can increase depending on how messy the Hit was, but it will not start at less than 6.

Then let the good times roll. 

Even if the agents are captured, there's always a chance bribery - the large splodge of wonga - will get them out. Of course, capture can be difficult to arrange when the country's up in arms ...

Enjoy!

A Nation State Robbing Banks: 80 Million and a Spelling Error (Night's Black Agents)

This post is inspired in part by Kento Bento's video about the biggest bank heist in modern history:

You may remember me mentioning this bank heist before, back in 2016 when not all the facts were in.

A couple quick points before I dive into Lazarus. Night's Black Agents Directors and agents wondering if Human Terrain is useful, wonder no more. Think about how cleverly this whole thing had to be coordinated: the thieves knew if they hit this particular bank on this particular day, and then transferred the stolen money to a bank in the Philippines, they'd be in the clear. Bangladesh, being Muslim majority, had its weekend on Friday and Saturday. The hack starts Friday. They come in on Sunday to sort out their problems, but they can't talk to their colleagues in New York because, on Sunday, their Christian colleagues are all off for the day. Monday works, but the bank in the Philippines, where the money is sent, is celebrating Chinese New Year, so it can't be contacted. That was fiendishly clever timing on someone's part.

Two, you may remember me mentioning a missing IT expert in the previous post. That expert, Tanveer Hassan Zoha, did turn up eventually. Detectives found him wandering near the airport and took him home, six days after he went missing. The IT expert claimed he could discover the identity of some of the culprits, and went with special police to the Bangladesh bank to have a look at the bank's records. Two days after that he was abducted from an auto rickshaw, and his family claimed the police were no help finding him. As far as I can determine his abductors were not caught. If he ever issued a public statement about his abduction, he didn't make it in an English language publication, as far as I know.

Bangladesh Airport connects to Hong Kong via Cathay Dragon, and Hong Kong is only a ferry ride away from Macau. That's where the alleged thieves went - it was a stopping point on their journey to North Korea, according to Kento Bento.

Which brings me to Lazarus Group, an entity that has been committing cybercrime since the early 2000s. Its earliest known attacks targeted South Korea, and it's alleged that the group has links to the North Korean government. This is difficult to prove, and might be a fake-out to throw blame on a believable straw man. That said, if anyone's going to think it's a good idea to back a group of crooks on a cybercrime spree, it's the dictator who may have poisoned his half-brother at an airport shopping concourse.

Lazarus has hit banks before, but banks aren't its only focus. It likes to hit South Korean targets, and allegedly was responsible for the Sony hack in 2014. The group demanded Sony withdraw its film The Interview, a comedy about an attempt on Kim Jong-un's life.

The Interview had so-so reviews and according to IMDB lost a ton of money - budget $44 million, worldwide gross something in the region of $12 million. Sony pulled the film from theatres in December 2014, allowing only a limited independent cinema release, and that after President Obama criticized Sony for giving in to terrorist threats.

Cybercrime experts Kaspersky Labs analyzed the Bangladesh hack, and give Kaspersky praise because it has nailed down the perfect hacking mini-scenario for Night's Black Agents Directors.

Initial Compromise. A single system inside the bank is breached with remotely accessible vulnerable code, perhaps through a webserver or a watering hole on a seemingly trustworthy website. The premise is simple: find a site you know the target visits, like a Chinese takeaway. The security on that site is bound to be less robust than the target's IT. Break it, infect it, wait for your target to visit - and the mouse takes the cheese. Snap!

Foothold Established. The group establishes persistent backdoors so they can come and go as they like.

Internal Reconnaissance.  The groups spends days, weeks, learning the network and identifying useful resources, like a backup server with vital information or an email server that can let the hackers into anything connected to that server. With the Bangladesh hack, Lazarus was particularly interested in SWIFT authentication, so it went after any server that might contain SWIFT authorization codes as well as IT admin systems.

Deliver and Steal. The great hack begins. Presumably followed by a scene Kaspersky does not mention, tentatively titled RUN AWAY!

This is the perfect breakdown for scenes in a game. What's more, they don't have to be about Digital Intrusion and nothing else. Human Terrain, Surveillance, Infiltration, Electronic Surveillance, potentially Flattery, Bureaucracy - all these will be useful, particularly in the early stages of the hack.

I see this as a potential Thrilling Digital Intrusion contest, starting with the initial compromise and moving through to final execution. The technothriller dialogue opportunities, particularly in the Initial Compromise or Internal Reconnaissance, are fascinating. It's a reminder that a Thrilling Contest doesn't have to be over in a few minutes. This one takes months - though at the table on the day the whole thing might take an hour's game time at most.

As for North Korea, well … it'd make a hell of a Node.

Enjoy!